Huawei Cloud DWS CPU Diag

• Outcome: Review
• Latest audit: Jul 7, 2026 · 5:53 PM UTC
• Version: 1.0.0

Overview

The core DWS CPU diagnosis workflow is mostly read-only, but the package includes unrelated OBS credential setup and risky secret-handling instructions that users should review before installing.

Install only if you need Huawei Cloud DWS CPU diagnostics and can provide tightly scoped read-only DWS credentials. Do not follow the OBS/obsutil setup unless you independently know it is required, avoid putting AK/SK values in command lines or chat, secure any config files containing secrets, and be aware that generated reports may be written to the workspace with sensitive cluster and SQL details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to write an HTML report into the local workspace, which exceeds the stated read/analyze/report purpose and introduces an unnecessary side effect. Unrequested file creation can overwrite existing files, leak sensitive diagnostic data into shared storage, or be abused as a stepping stone for broader filesystem writes if similar patterns are normalized.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest presents the skill as producing a diagnosis report, but later instructions require persisting that report to disk, creating a capability mismatch between declared behavior and actual behavior. This hidden side effect undermines user/operator expectations and can cause sensitive cluster data to be stored locally without clear authorization or review.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file is materially misaligned with the declared DWS CPU diagnosis skill and instead documents OBS tooling installation and authentication. In a security-sensitive agent skill, irrelevant cloud storage tooling and credential setup expands the capability surface, can mislead operators into provisioning unnecessary access, and may enable unintended data access paths unrelated to CPU diagnosis.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The guide introduces OBS-specific credential configuration and bucket access verification that are not justified by the skill's stated purpose. This encourages users to configure long-lived AK/SK credentials for an unrelated service, increasing secret exposure and violating least-privilege expectations for a DWS diagnostic skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Saving an HTML file without any user-facing warning or consent is dangerous because it causes a non-obvious state change on the local workspace. In a diagnostic context, the generated report may contain cluster identifiers, node names, SQL text, usernames, and timing data, turning silent persistence into a confidentiality and governance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The obsutil example places AK/SK directly on the command line, which can leak secrets through shell history, process listings, audit logs, and terminal recording. In the context of an agent skill, this is more dangerous because users may copy-paste commands verbatim while handling privileged cloud credentials.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide explicitly tells users to place plaintext AK/SK credentials into a YAML configuration file before first use, with no strong warning about file permissions, secret handling, or immediate secure entry alternatives. Even if the server later auto-encrypts the values on startup, the credentials exist in plaintext at rest beforehand and may be exposed through backups, source control mistakes, local compromise, or accidental sharing.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The CLI example passes the access key and secret key directly as command-line arguments, which commonly exposes secrets via shell history, process listings, audit logs, CI job logs, and telemetry. In an operations-focused MCP setup that manages cloud access, leaked AK/SK values could allow unauthorized API access to DWS and potentially broader cloud resources tied to those credentials.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.